Posted
by
timothyon Thursday April 04, 2013 @04:28PM
from the quick-name-an-os-that's-never-been-compromised dept.

An anonymous reader writes "We frequently have guests in our home who ask to use our computer for various reasons such as checking their email or showing us websites. We are happy to oblige, but the problem is many of these guests have high risk computing habits and have more than once infested one of our computers with malware, despite having antivirus and the usual computer security precautions. We have tried using a Linux boot CD but usually get funny looks or confused users. We've thought about buying an iPad for guests to use, but decided it wasn't right to knowingly let others use a computing platform that may have been compromised. What tips do you have to overcome this problem, technologically or otherwise?"

I understand your point but the problem is that many, maybe most people don't know any better. They don't even know how to take responsibility.

I would never let a guest run Windows. I have guest accounts on a couple of Linux machines. All they get on the desktop is a browser icon or two (Firefox and Chrome). That's more than enough for anything a guest needs to do and I don't see how they can get confused.

If they have things to do like edit documents or write papers or whatever, they probably have already brought along a laptop and they can use my network with little chance of harm (other than blatantly illegal activity). Or they can use their Google Drive account.

Windows may be a problem here, but the built-in guest account on OS X is perfect for this purpose. Enable it, and guests can log in the guest account (no password), which acts like a standard user account (they have full access to the browser and any other globally-installed apps) except that at logout, the entire account is wiped clean. Since your guests don't have administrator access to your computer they can't mess up anything outside the guest account, and anything they do inside that account is automatically cleaned up for you when they're done.

Friends who respect you will take care when using your stuff. They will ask permission and they won't willingly or carelessly damage, and they will replace what they do break, and if they can't, they won't borrow it in the first place. The gp is right: today's culture doesn't teach respect of property, self, or the truth. Immediate indulgences and the expectation of entitlements are stronger social imperatives these days. Saying 'no' has become 'offensive' because no one should ever be so mean! Choosing not to share all the time, or even being choosy with whom you choose to share with is considered 'anti-social.'

If you are running Windows then with any luck you are running Win 7 Pro. If you have the Home version you can upgrade with the "Anytime upgrade" bit.
With Win 7 Pro you can install XP Mode which is an XP virtual machine. Set up a guest user and set that to autorun the XP Mode VM in full screen. Once it is setup make a copy of the VHD as a backup. They can hose it up all they want and when they are done just delete the VHD and copy in the fresh copy from the backup.

Or just install VMware on any version of windows and boot them into that. You don't need windows 7 pro and some anytime kit. Still think a five year old MacBook would be easiest, it will run flash and familiar browsers but less likely to get viruses and spyware, and if you want you can use time machine to roll back to the original install, that will wipe anything they ever did. System restore is available for windows too but mac time machine works better.

The OP most likely doesn't have Mac as most Mac users believe they are immune from the problems of malware. (Lower probability of blindly running blindly off a cliff is not the same thing as immunity...) The OP almost certainly doesn't use Linux seeing they way they differentiated the Linux boot CD from their normal environment.
So if they want to install an add on VM system like VMware they can:
- Acquire and install the virtual host software
- Figure out how to install the virtual OS inside the host
- Figure out how to activate and/or license the virtualized OS

Or if the OP has Win 7 (pretty good odds)
- They can follow the prompts on the download page for XP Mode and get a legally licensed, preloaded, and activated copy of Win XP in a virtual environment that 95% of adults will be able to navigate with no learning curve. I was mistaken earlier when I thought XP Mode required the Pro version of Windows. (Pretty uncharacteristic of them to make something like that available for free across the whole product range.)
The download link is: Microsoft Download Center - XP Mode [microsoft.com]. Just follow the page instructions and download and install the pieces and you are golden. I would create them a separate Win 7 user and remove all the obvious icons for anything local to keep them from mucking things up.

Once it is in it runs as if it is an RDP session to a remote computer. Very simple.

But yeah, if you want to buy or stealware a more difficult solution, then yeah, that is possible.

After all the hype it didn't deliver any more than Virtualbox and all the others.

Except for the part where it can be setup by non techy types by installing three "updates" from a single simple download page. Plus it comes with a pre-installed, licensed and activated copy of virtualized XP for 0$ that is legal for free use even in enterprise environments.

I consider myself to usually be on the bleeding edge of technology, but phone-based boarding passes are right out. I've never had a piece of paper run out of power, but I've had my phone die halfway through the travel day for reasons unknown (turned into a little toaster and burned through its battery - presumably the radio got in a weird state) and have had it stolen while traveling. I keep two boarding passes, typically - one folded in my pocket, and one in my carry-on. If I lose one, I just grab the other one.

And yes, most of the time when my guests want to borrow a machine, it's because they need a printer for boarding passes.

When a guest only needs a boarding pass I offer to print it for them. If they insist on doing it themselves they get to use a Linux guest account. If they can't figure out how to print with that, I again offer to do it for them. I never let guests run Windows, I don't even run it myself very often.

Then it appears you disagree with some other Slashdot users who have told me that smartphones are a luxury, not a necessity. The only necessity is an $80/year dumbphone in case of urgencies, and that's only because payphones are being removed. But I'm willing to consider your arguments as to why a smartphone is a necessity.

Have a dedicated Linux boot just for them, and if they give you funny looks tell them too bad.

Once you have Linux, it doesn't have to be dedicated. Just use a Guest Account with permissions to use the browser, and not much else.

The big thing is just get rid of Windows in your home. You have nothing that needs interoperability with your work thatcan't be handled by Linux. Once you dump Windows, all the bad browsing habits no longer matter.

The problem here is the insistence of keeping Windows for no good reason.

If you have a license already, why not use it?
Use that license to run on a VM. You can run Linux on your host, and you give the guests the possibility of using a "Windows machine" which is only a VM, you can revert to a previous state once they have used it.

The issue is not about getting rid of Windows, is knowing that you very likely paid for a license, so why not put it to use anyways?

Set up a VM in Virtual Box for them to use. Take a snapshot of when it was healthy and new and just revert to that each time someone wants to use it. Even paying for a Windows install for the VM would be cheaper than an iPad.

Which, for some reason that probably had nothing to do with pushing AD and group-policy tinkering on a bunch of schools and libraries and other relatively unsophisticated organizational users, is why Microsoft killed it. Support ended a couple of years back, availability 3-ish. No 64-bit or Win7 compatible version ever existed.

I actually bothered with a license for DeepFreeze for the one box that I allow guests to use. That, a Kensington lock, BitLocker and proper password protection of the BIOS and the HDD is good enough.

That way, the DeepFreeze-protected machine is one reboot away from getting cleaned up from whatever ails it. Especially with the fact that the guest user has no administrator rights, so malware would have to find a hole to get to a Windows admin context, then find a way to attack the DeepFreeze driver in order

Agreed. You can also run the machine in a non-persistence mode so that nothing is written to the disk at all while in use. Just periodically fire it up in a persistent state to apply important security updates etc for their safety. Unless they are savvy they won't even know they are running in a VM.

For VirtualBox, the method I use is slightly different but gives similar results in the end.This must be done from the command line with the vboxmanage.exe tool, I'm not aware of a GUI way to do it.

I have a 'template' VM with fully setup windows and configured how I want it.Then I make a new 'guest' VM (from scratch) and copy the template disk image to a new name (cloned, from virtual media manager), from template.vdi to guestbox.vdi, and then I use a command line tool to set the new disk image immutable, so it can not be changed again.

vboxmanage modifyhd whereever/guestbox.vdi --type immutable

Then point the guest vm to the guestbox.vdi image under settings -> storage.

Each time the VM boots, disk writes go into a seperate copy-on-write file, which gets deleted once the VM is powered down. A "revert" action takes as long as a delete command unlinking an inode.

When I need to make updates, I do that in my template vm, then copy over the vdi setting it immutable again. Copy the new guest image over the old one, and the VM is updated.

It's a Firefox addon. Check it out. Also Adblock Plus. With those two installed and running, things get a lot safer. Of course, NoScript requires a bit of savvy to be able to browse the web correctly. You might have to help. Otherwise, tell them to bring their own darn laptop.

The moment your computer becomes public (however limited that "public" is), it is a goner. It is like asking how to secure your computer after it was compromised.

I don't even let my visitor plug into the same network my main computers are, and have both a separated WiFi network and a separated ethernet segment for them (1 port only in the guest room), that I treat as a DMZ. Ok, I'm paranoid, but still.

Maybe use removable HDs, and keep one for your own use, and swap it for an entirely different one (which you can restore from a Ghost image or something) for your guests. As in PHYSICALLY disconnecting your HDs when they are going to use.

I don't even let my visitor plug into the same network my main computers are, and have both a separated WiFi network and a separated ethernet segment for them (1 port only in the guest room), that I treat as a DMZ. Ok, I'm paranoid, but still.

I shudder to think what booby traps you set up to keep your house guests away from your silverware and jewelry.

What kind of guests do you have? Why do they spend so long using the Internet that managing it becomes an issue?

My flatmate is from a different country, and regularly has friends visiting. They often ask to print a ticket or boarding pass, check email, check Facebook, but it's never been a problem. They can log in as guest on any computer, and the wifi password is on a post-it by the router.

Something like VirtualBox or VMWare that supports snapshots. Install an OS into the virtual machine and set some firewall rules to keep it from accessing anything else on your network. When they ask to use your computer, launch the virtual machine and set it to full screen. They won't know the difference. When they're done, revert to snapshot.

Setup a windows XP virtual machine. Save a snapshot, or a VDI/VMDK file of a clean hard drive image. When they come, boot up the virtual machine in full screen. When they leave, restore the clean snapshot or clean hard drive image.

Just create an ad-hoc guest account with limited rights. That way they can't really screw up things. Once the guest has left the premises, remove the account. You don't even have to log out yourself if someone just needs the access for five minutes, just switch users.

A step further: Build a virtual machine with a e.g. your basic Linux distro or Windows XP, create a snapshot of it in it's "fresh" state, and set it up to talk only directly to the Internet without any access to your local network. You can achi

The guest account is the way to go. Anything that infects the PC is unlikely to make it past the guest account as long as you keep your Windows Updates up-to-date. I would also recommend going the extra step and setting ACLs to deny usage of Internet Explorer. Install Firefox and/or Chrome.

Use two routers. The turn wi-fi on both. Give the password to the outer router to your guests and ask them to BYOC, bring your own computers. Use the second router, the inner one, to run your home network. Close all the ports and be very secure on the second router. Tell your guests your PC has a virus and so you don't want others connecting to it or using it till you get some help to disinfect it.

The media PC in my living room boots directly into the Guest account. Under the guest account I can USE almost all the programs I have installed seamlessly. There are some minor issues with software updates, XBOX controllers, and a complete inability to configure network settings, but that's about it. If I need to do anything that requires more rights I can deal with the UAC prompts that show up or simply log out and back in as an admin.

I know it's not flawless but I still feel pretty comfortable letting my tech savvy (e.g. dangerous) friends stay over unattended. It wouldn't hold up to anyone seriously determined to break the security but they have access to the physical machine and can't really be stopped anyway.

Most of the new WiFi routers offer guest networks. Set one up and tell them to bring their own device. With the number of people with smartphones, I don't really see a legitimate need to set up guest computers.

With Windows inside the VirtualBox. Once the guests leave, revert the VirtualBox image.

With a little work, you can make a "guest" login that launches VirtualBox and can't do anything else.

On the other hand, it might be enough to make a "guest" account, and just run a script that cleans out/home/guest after the users leave:# remove all trace of guest directoryrm -fr/home/guest# set up clean copy againcp -pr/whatever/guest/home

If you are using Linux Mint with MATE, your guests should be able to cope with

"We've thought about buying an iPad for guests to use, but decided it wasn't right to knowingly let others use a computing platform that may have been compromised."

Seriously? What have you been reading that gives you bizarre notions like that? The iPad has a number of general shortcomings, most of which are related to its single-user OS and its closed architecture. And I'd hesitate to lend a guest my iPad, but only because – once unlocked for use – it's wide open for the user to poke around (e.g. read my mail, browser history, etc). But in terms of the OS being compromised, an iOS device that hasn't been deliberately jailbroken (by you) is about as safe an internet-access device as you're likely to find, short of custom building a Linux- or BSD-based system yourself.

Create an account that does not have the ability to change the operating system, a "user" account for your friends. It won't prevent all problems, but it does cut down on the ability of malware to corrupt you system outside that user's folder.

Let them run Puppy and if they get confused lend them a hand. Usually most people seem to want to check email or some other trivial task. You do want to be certain that your email account does not allow auto sign in while you have company.

Keep an extra media bay or hard drive for a notebook that lets you just remove your hard drive and stick another in.Take your regular hard drive and put it away when you've got guests coming over. let anyone use your notebook with this alternate media to boot and run from. Just keep a.iso or other backup from which to do a restore.At the end of the night, just reimage the alternate media and put it back on a shelf.Put your drive / boot media back in and you've got your machine back. No worri

We've thought about buying an iPad for guests to use, but decided it wasn't right to knowingly let others use a computing platform that may have been compromised.

If you're willing to buy a $499 iPad [apple.com] just for guests to use, then you'd probably be willing to buy a $249 Chromebook [google.com] instead. It's a great second laptop, and perfect for guests to use. There's even a "Guest" account they can use, and it clears the data when they are done using it. And it's secure - which you want if your guests have "high risk computing habits."

If you have a Mac, there's a standard user account called Guest. This account has privileges to do normal user things, but can't install apps or make other changes to the computer. (And the account has no access to other users' data.) No matter what the guest user does in that account, it can't hurt you —and the entire Guest account is in a fresh state each time you log in to it. It's designed exactly for something such as this, and it works very, very well in real use.

2nd this. Use it all the time to give friends and colleagues access to their email while traveling or whatever. Wipes all data when they log out. Need a mac though; doing hackintosh for just this is overkill.

These comments suggesting a Linux boot CD, or a Virtual Machine (VMWare , VirtualBox, etc) are all viable solutions if you trust your guest to stay within the environment you give them.

A VM, in my opinion, is really just useless, because the guest can switch away from it too easily and get at your main machine. Then perhaps become confused which browser is which, see your firefox on the desktop, double click and continue away... This is common with guests that are not too computer savvy....

Someone mentioned using a VM with a guest network and router firewall rules?? that's just more useless, the guest is sitting at your main machine. See the point above.

A linux boot CD is much better than a VM, with firewall rules to prevent this booted machine from accessing the local network, but any linux environment gives local access to local drives, so before you know it your (computer savvy guest) is browsing your local hard drive from your standard everyday system you use, and reading all your fine datas. Or if they are a reboot happy user (I've seen that, if the browser gets slow they power off) then that user may reboot when you're out of the room, and they may now boot into your main system and continue along, without you even knowing it, until much much later. You won't know this unless you are watching what they are doing every minute, and I am sure that won't go over well either.

The only way to go here is to have a separate guest network (hardwired or wifi or both) and have your guests BYOD. If you wish to be accommodating when they don't have their own device then you can give them a slow, cheap, small laptop from craigslist or something, and make them use that. Use any hard drive mirroring software to wipe and reinstall the Linux OS on it after they leave, or use a netboot to boot an image from a local server which you have a virgin copy of for the next user. As someone else already said, make sure it can access the printer, guests always want to print something.

I do the above. An old DELL Latitude D600 is the device for my guests. It has a 14" screen, 1 GB RAM, Pentium M 1.6Ghz, a 30GB hard drive, and dual boots Linux Mint or Windows XP so they have a choice if they care. The entire HDD is overwritten from a server image when they are done.

I say all this because I am the type of person that doesn't want anyone sitting at my local machine. I wish to give them full access, freedom to take their time and do what they want, without me watching guard over them to be sure they aren't reading anything of mine. I don't want them to start my Yahoo, or MSN , or read my email, my PC has years of financial data on it, local documents to my Condominium Corporation, letters to family, and the other 50% is... well... we all know what the Internet is really for;)

I made an account with username 'guest' and password 'password'. then just let them log on.

I also had ssh installed. one day the sysadmin at work come to see me and tells me that my laptop had been blocked from the network because it was making a large number of outgoing ssh connections. important lessons were learned.

(some distros offer a locked down password-less guest account. this is a much better idea)

And put it in its own separate guest network, which is logically isolated from your own stuff by a firewall, maybe run a print server too (people often want to print boarding passes)...As for funny looks, a browser is a browser and i've never had any problems giving someone a linux livecd, it has both firefox and chrome and most people are perfectly familiar with these applications.

And put it in its own separate guest network, which is logically isolated from your own stuff by a firewall, maybe run a print server too (people often want to print boarding passes)...As for funny looks, a browser is a browser and i've never had any problems giving someone a linux livecd, it has both firefox and chrome and most people are perfectly familiar with these applications.

Why go to the trouble of a separate network?The odds of even the most retarded of users inadvertently fucking anything beyond the one machine they're touching is absurdly low, unless you're running outdated shit on your network. Remote exploits are remote exploits, and you should protect each device regardless or whether or not you trust the rest of the network.

If someone is so fuck-up prone that you think your proper boxen could be fucked by some schlub lolcatting around on the same network, you should be more worried about them tripping in your house and suing you.

There was a time in the distant past that I built a "very special" win9x machine for this very purpose.

Yes, I can read your mind. "Win9x? Are you fucking serious? Turn in your geek card right now!" Yadda, yadda.

Just hear me out.

Win9x, because it relies on realmode dos interrupt disk handlers, can be loaded from a preboot environment ram only block device. Such as that provided by Memdisk, from the syslinux tool set.

Essentially, you have a disk image file on a bootable EXT2 volume (nothing ever gets written on it, so it doesn't need a journal.) With the syslinux bootloader on the MBR. It is the default boot device.

On boot, syslinux starts, loads the memdisk block device driver, and copies the win9x image into ram, it patches int15 to report a different max size of installed XMS, then executes the "mbr" of the ram block device.

BOOM. Win9x in a ramdisk.

You can use a drivespace compressed image to achieve maximum data density for the consumed block of memory. Drivespace3 with ultrapack on gets almost 2:1 packing on normal program and file data. You can get a *lot* of stuff inside a 512mb image file.

Throw in a reasonably recent firefox, courtesy of KernelEx (an open source kernel resource extender for win9x, which allows a good deal of 2k and XP native applications to run, including FF10, and a modern flashplayer with ABP and noscript.) And a good software firewall, turn off all filesahring services, and essentially lock down the 9x system as far as possible, and you have exactly what your horrible family member and or aquaintence wants: a familiar user environment that they can walk all over.

It also has what you want: pull the plug, and it is magically fresh, clean, shiny and new again as soon as you power it on.

9x doesn't know how to deal with EXT filesystems, so the physical HDD is never exposed to your user.

The only major problems are 9x's abhorrent 2gb RAM limit, and its abysmal network safety rating, coupled with its rather dated hardware base. (Plus the difficulty of getting a 9x install up and running smoothly with all the perks a normal user could want, without breaking it, on a teensy weensie volume.)

On the plus side, being 100% in RAM on a reasonably modern hardware platform, it is fast as fuck. The test systems I built had Office97, firefox 10, flashplayer10, the WEP, a pirate copy of zonealarm pro, photoshop7, media player 10, KernelEx, and a few other odds and ends on it, with 50mb of "free" space left on the compressed volume to serve as browsing cache space. It was snappy as hell.

I have only done this a few times as just a lesson in self-punishment/"let's see what kind of frankenstein's monster we can build out of retro parts!" Type exercise, but the finished product is incredibly hard to kill, and keep dead. Bluescreens of death? Caught a nasty worm in the 10 seconds it was on the net? Power it off, power it back on. Good as new.

Gives a whole new meaning to "zombie workstation".

I have a celeron POS I am contemplating doing this to actually. I would prefer ramdisked win2k or better though, but I don't know of a way to boot the OS out of a block device after NTLDR starts, and before control is passed to NTOSKRNL. Maybe a hacked FreeLDR from reactos would work though.

It's main function is to take a windows xp (or 2k i believe) installation cd, a folder of special packages to include, and optional custom config files (ie network settings) all as input.. and gives you a bootable ISO image as output.

Obviously it's meant to create a boot cd/dvd, but using syslinux similar to how you do, one can boot that ISO directly off a USB flash device as well.Flash makes it fast, and easy to overwrite the ISO for any system upgrades. No optical media slowdown either.ISO makes it read only while running from a RAM disk, so is quite fast.

For just running a web browser, it at least gives you a slightly newer kernel and base system to build upon.

Still, I'll have to play around with your method too, as I have some old legacy 95 and 98 boxes at work I need to keep alive for the foreseeable future, where in some of those cases virtualization isn't an option.(I've managed to virtualize custom ISA cards, but can't say the same for custom PCI cards)

I am not sure why users give you funny looks with Linux. Is it because things like Flash/Java plug-in/etc. are not installed?

Flash and Java are standard parts of a modern Linux install these days, such as the latest versions of Linux Mint.

Maybe they gave him funny looks because he installed Ubuntu, or worse, Fedora, and they were sudddenly exposed to the horrors of Unity or Gnome3. Just when Linux was really looking like a viable replacement for Windows on the desktop(/laptop) for regular users, Unity an